Design solutions that align with security best practices and priorities →mediumMultiple ChoiceObjective-mapped
Conditional Access Policy for Managed Device Email Access
A company uses Microsoft Entra ID for identity management. They want to ensure that only managed devices can access corporate email. Which Conditional Access policy setting should be configured?
Quick Answer
The answer is to configure the Conditional Access policy setting "Require device to be marked as compliant." This setting works by checking that the device is enrolled in Microsoft Intune and has passed all defined compliance policies—such as encryption, OS version, and jailbreak detection—before granting access to corporate email. On the Microsoft Cybersecurity Architect exam, this tests your understanding of how Conditional Access integrates with device management to enforce a zero-trust posture; a common trap is confusing "Require compliant device" with "Require hybrid Azure AD join," which checks domain membership but not health. Remember that compliance is about the device’s current security state, not just its identity. A helpful memory tip: think "Compliant = Clean and Current," meaning the device must meet your security hygiene rules right now, not just be joined to a domain.
⚠ Common exam trap
It's easy for candidates to confuse 'Require device to be marked as compliant' with 'Require approved client app' or 'Require multifactor authentication,' thinking that MFA or app approval alone ensures device management, but only compliance enforcement ties directly to Intune-managed device policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require device to be marked as compliant
To ensure only managed devices can access corporate email, you need to enforce device compliance. The Conditional Access policy setting 'Require device to be marked as compliant' checks that the device is enrolled in Microsoft Intune and meets all compliance policies (e.g., encryption, OS version, jailbreak detection) before granting access. This directly restricts access to managed devices only.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require multifactor authentication
Why it's wrong here
MFA does not enforce device management.
- ✗
Block legacy authentication
Why it's wrong here
This blocks old protocols, not unmanaged devices.
- ✗
Require approved client app
Why it's wrong here
This restricts app usage, not device management.
- ✓
Require device to be marked as compliant
Why this is correct
This ensures only managed and compliant devices can access.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization wants to ensure that all Windows 10 devices are compliant with security policies before they can access corporate email. Microsoft Intune is used for device management. Which component should be used to enforce compliance and block non-compliant devices?
easy- A.Intune device compliance policy alone
- ✓ B.Microsoft Entra ID Conditional Access policy integrated with Intune compliance
- C.Microsoft 365 Defender portal
- D.Microsoft Defender for Endpoint device risk score
Why B: Microsoft Entra ID Conditional Access policies can evaluate Intune device compliance status in real time. When a device is marked non-compliant by an Intune compliance policy, the Conditional Access policy blocks access to corporate email (e.g., Exchange Online) until the device is remediated. This integration enforces a 'compliant device required' gate that cannot be achieved by Intune compliance alone, which only reports status without blocking access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.